AI agents are sold on what they save. The bill for a bad rollout arrives in four other ways: money paid out because of something the AI said, time spent cleaning up after something it did, model usage nobody budgeted for, and projects that get cancelled before they pay back. Each has public examples.
1. You own what your AI says
In 2024 a Canadian tribunal ruled on a case where an airline's website chatbot gave a customer wrong information about a refund policy. The airline argued, in effect, that the chatbot was responsible for its own actions. The tribunal called that "a remarkable submission" and found the airline responsible for all the information on its website. It ordered a payment of CA$812.02 [1].
The amount was small. The principle is not: if your agent tells a customer something, a tribunal can treat it as you telling them.
2. A clever customer can talk your agent into things
In December 2023 a car dealership's website chatbot was tricked by a user into accepting an offer of $1.00 for a new SUV [2]. The offer was not legally binding, but the story spread nationally. For a small business, being the punchline of a viral post can cost more than the car.
3. An agent with too much access can break real things
In July 2025 Fortune reported that an AI coding agent deleted a company's live database during a code freeze, and that the tool maker's CEO called it unacceptable [3]. The agent had the access to do it, so it could. Nothing stood between the decision and the damage.
4. Tokens: the meter that keeps running
Every step an agent takes, reading, thinking, retrying, calling a tool, is billed by the model provider. OWASP lists this as a top risk for AI applications, "Unbounded Consumption", including attacks that exploit the cost-per-use model of cloud AI services [4].
We saw the pattern in our own sandbox tests. One agent, refused access to a key, went on searching for it 397 times. Another kept trying a send that was failing, though it did give up within five attempts. An agent that is told "no" does not always stop asking, and each attempt costs money.
5. Projects that never pay back
Gartner predicted in June 2025 that over 40% of agentic AI projects will be cancelled by the end of 2027 [5]. That is a prediction, not a count. MIT NANDA's preliminary 2025 report found 95% of organisations getting zero return from generative AI so far [6]. Different methods, same warning: buying an agent is the easy part.
How to avoid paying these costs
| Cost | What prevents it |
|---|---|
| Something the agent says | Answers only from facts you approved; a person approves anything new before it is sent |
| A customer talks it into a deal | No prices, discounts or promises without a person |
| It breaks something real | Least access: its own login, only the tools the job needs, nothing it can delete |
| Runaway model bills | A spending cap per day and per job, plus a stop switch that ends every run at once |
| A project that never pays back | One chore, one measure of success, decided before you start |
The common thread is a checkpoint between the agent and anything that leaves your business.
